A first conventional time keeping device 100 for maintaining a processor's "real time clock" is illustrated in block form in FIG. 1. Real time clock values are typically used by computer-implemented processes for scheduling tasks and for time tagging sent or received data. Referring to FIG. 1, a counter time register 104 of time keeping device 100 has a clock input to receive a time reference clock signal CLKR. The value held in the counter time register 104 is adjusted at a frequency equal to the frequency of the time reference clock signal CLKR. For example, a 32,768 Hz crystal oscillator reference 106 is often utilized to generated the time reference clock signal CLKR. In this case, the time value held in the counter time register 104 would be incremented at 32,768 Hz.
Bus decoding logic 114 determines from control signals BUS.sub.-- CNTL present on a system bus 108 when the time keeping peripheral device 100 is being accessed (e.g., by memory-mapped access) by a processor 110. In response, a time keeping request signal TIME.sub.-- ADR is asserted. Gated clock generation circuitry 111 uses the time keeping request signal TIME.sub.-- ADR and a system clock signal CLKS to generate a "gated" system clock signal CLKS.sub.-- G. The gated system clock signal CLKS.sub.-- G is provided to an enable input EN of bus interface circuitry 112. When the gated system clock signal CLKS.sub.-- G is asserted, the bus interface circuitry 112 responds by providing the value held in the counter time register 104 (or a portion of the value) as a real time clock value to the processor 110 via the system bus 108.
The frequency of the system clock signal CLKS is typically at least one order of magnitude greater than the frequency of the time reference clock signal CLKR. It can be seen that the decoding logic 114, the gated clock generation circuitry 111, and the bus interface circuitry 112 serve to synchronize the system clock signal CLKS to the time keeping clock signal CLKR.
However, a problem with the conventional time keeping device 200 is that an attacker, by driving the crystal oscillator reference 106 in an abnormal or unexpected manner, may be able to disarm security features of the processor 110 that are implemented in software and/or firmware which the processor 110 is executing. That is, by causing erroneous real time clock values to be provided to the processor 110, the processor security routines may become corrupted or confused.
A conventional secure time keeping device 200, illustrated in block form in FIG. 2, addresses these security issues with one or more system time registers 218, where each additional system time register 218 provides an additional level of security. (Where the components are the same as those of the other figures, they are given the same reference designations. For example, the counter time register 104 shown in FIG. 1 is identical to the counter time register 104 shown in FIG. 2.) In particular, the system time registers 218 operate by latching the value held in the counter time register 104 responsive to edges of the system clock signal CLKS. By contrast, the bus interface circuitry 112 operates responsive to the gated system clock signal CLKS.sub.-- G. The conventional secure time keeping device 200 is susceptible to passing on invalid clock values only during the relatively short period of a system clock signal CLKS edge, thus narrowing the window during which invalid clock values may be sampled, even if the time keeping clock signal CLKR is driven in an unstable manner.
While the system time registers 218 address the security problem, a disadvantage of including the system time registers 218 is that they consume power at all times, even when the processor 110 does not require a real time clock value. Thus, what is desired is a secure time keeping device which is operable with relatively low power consumption.